May 2007 - Test - lists.nanog.org

Re: How many others are nullrouting BT?
by Jo Rhett 17 May '07

17 May '07

Matthew Smith wrote: > What address did BT give you? 221b Baker Street, London You know, I am normally very against the over-the-top demands that law enforcement try to place on carriers. Certainly the non-standard format for delivery of data that CALCEA requires is a prime example. But situations like this, where BT gives US local, US federal and even UK police the runaround gives me a lot more sympathy for their situation. I do hope that when the UK police get tired of waiting, that they shut down everything in BT's data centre and take it all as evidence. BT deserves at least that, and frankly a whole lot more. A local fraud group is trying to determine if anyone whose card was stolen was a UK citizen so that a lawsuit against BT is possible. -- Jo Rhett senior geek Silicon Valley Colocation

4 7

Broadband routers and botnets - being proactive
by Gadi Evron 17 May '07

17 May '07

In this post I'd like to discuss the threat widely circulated insecure broadband routers pose today. We have touched on it before. Today, yet another public report of a vulnerable DSL modem type was posted to bugtraq, this time about a potential WIRELESS flaw with broadband routers being insecure at Deutsche Telekom. I haven't verified this one myself but it refers to "Deutsche Telekom Speedport w700v broadband router": http://seclists.org/bugtraq/2007/May/0178.html If you all remember, there was another report a few months ago about a UK ISP named BeThere with their wireless router being accessible from the Internet and exploitable, as another example: http://blogs.securiteam.com/index.php/archives/826 Two issues here: 1. Illegitimate access to broadband routers via wireless communication. 2. Illegitimate access to broadband routers via the WAN. I'd like to discuss #2. Some ISPs which provide such devices (as in the example of #2 above) use them as bridges only, preventing several attack vectors (although not all). Many others don't. Most broadband ISPs have a vulnerable user-base on some level. Many broadband ISPs around the world distribute such devices to their clients. Although the general risk is well known, like with many other security issues many of us remained mostly quiet in the hope of avoiding massive exploitation. As usual, we only delayed the inevitable. I fear that the lack of awareness among some ISPs for this "not yet widely exploited threat" has resulted in us not being PROACTIVE and taking action to secure the Internet in this regard. What else is new, we are all busy with yesterday's fires to worry about tomorrow's. Good people will REACT and solve the problem when it pops up in wide-exploitation, but what we may potentially be facing is yet another vector for massive infections and the creation of eventual bot armies on yet another platform. My opinion is, that with all these public disclosures and a ripe pool of potential victims, us delaying massive exploitation of this threat may not last. I believe there is currently a window of opportunity for service providers to act and secure their user-base without rushing. Nothing in security is ever perfect, but actions such as changing default passwords and preventing connections from the WAN to these devices would be a good step to consider if you haven't already. My suggestion would be to take a look at your infrastructure and what your users use, and if you haven't already, add some security there. You probably have a remote login option for your tech support staff which you may want to explore - and secure. That's if things were not left at their defaults. Then, I'd also suggest scanning your network for what types of broadband routers your users make use of, and how many of your clients have port 23 or 80 open. Whether you provide with the devices or not, many will be using different ones set to default which may pose a similar threat. Being aware of the current map of vulnerable devices of this type in your networks can't hurt. It is not often that we can predict which of the numerous threats out there that we do not address currently, is going to become exploited next. If you can spare the effort, I'd strongly urge you to explore this front and be proactive on your own networks. The previous unaddressed threat which most of us chose to ignore was spoofing. We all knew of it for a very long time, but some of us believed it did not pose a threat to the Internet or their networks for no other reason than "it is not currently being exploited" and "there are enough bots out there for spoofing to not be necessary". I still remember the bitter argument I had with Randy Bush over that one. This is a rare opportunity, let's not waste it. We are all busy, but I hope some of you will have the time to look into this. I am aware of and have assisted several ISPs, who spent some time and effort exploring this threat and in some cases acting on it. If anyone can share their experience on dealing with securing their infrastructure in this regard publicly, it would be much appreciated. Thanks. Gadi Evron.

11 16

RE: [cacti-announce] Cacti 0.8.6j Released (fwd)
by michael.dillon＠bt.com 17 May '07

17 May '07

> how do you define your schema? > how long does it take to insert/index/whatnot the data? This is a much bigger deal than most people realize. Poor schema design will cause your system to choke bade when you try to scale it. In fact, relational databases are not the ideal way to store this kind of data so when you design your schema, you are really fighting against the database to wrestle it into something that will work. > this is a huge burden to figure it all out, implement > and then monitor/operate 24x7. miss enough samples or data > and you end up billing too little. this is why most folks > have either cooked their own, or use some expensive suite of > tools, leaving just a little bit of other stuff out there. Personally, I doubt that it is possible to build a workable system, even with plugins, that will do the job for a significant percentage of service providers. Different companies have different needs, different hot button items, etc. This is an area where breaking the problem down into well-defined separate problems with a well-defined linkage, will go a long way. But to start with, just solving the data storage problem is a good place to start. If someone can create a specialized network monitoring database that scales, then the rest of the toolkit will be much easier to deal with. Note that people have done a lot of research on this sort of time-series database. People working in high-energy physics also have to deal with massive sets of time-series data. There is plenty of literature out there to help guide a design effort. But Open-Source developers don't usually do this kind of up-front research before starting coding. Money and manpower won't solve that kind of problem. --Michael Dillon

13 16

Stop! Please! Re: Broadband routers and botnets - being proactive
by Scott Weeks 17 May '07

17 May '07

--- ge(a)linuxbox.org wrote: > try to educate those people. Write CEOs/CTOs/CSOs > educating them and push the security teams for these : I am unsure of where else to go with this, and if Are you reading and thinking before responding? scott Please stop this on nanog. Please continue it on nanog-futures. Please!

1 0

RTT from NY to New Delhi?
by Joe Maimon 16 May '07

16 May '07

What should I expect? I am seeing ~350 from a vendor provided mpls cloud to a site in Sukhrali Chowk, Gurgaon, Haryana, India Thanks, Joe

12 14

Re: Broadband routers and botnets - being proactive
by Fergie 16 May '07

16 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Suresh Ramasubramanian" <ops.lists(a)gmail.com> wrote: >On 5/12/07, Albert Meyer <from_nanog(a)corenap.com> wrote: > >> I and numerous others (including some whom any reasonable NANOG-L poster >> would respect and listen to) have asked you repeatedly to stop trolling >> NANOG-L with this botnet crap. It is off-topic here. The last time you >> pulled this (starting > >As frequent as Gadi is with his botnet posts, insecure and wide open >CPE getting deployed across a large provider is definitely >operational. Suresh is right -- if you don't think CPE compromises are an operational problem, then I'm not sure what is. :-) [changing gears] I'll even go a step further, and say that if ISPs keep punting on the whole botnet issue, and continue to think of themselves as 'common carriers' in some sense -- and continue to disengage on the issue -- then you may eventually forced to address those issues at some point in the not-so-distant future. I understand the financial disincentives, etc., but if the problem continues to grow and fester, and consumer (and financial institutions) losses grow larger, things may take a really ugly turn. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.1 (Build 1012) wj8DBQFGRXxaq1pz9mNUZTMRArMKAJ9r5LymJwHl70u7b3XU5XzvB88WugCfWRFO jWmj4+AadZTVBwQ6VGjUmHE= =oZYK -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

13 15

Re: Colocation facilities in britian
by Stuart Henderson 16 May '07

16 May '07

> Does anyone have ballpark costs on what colo space costs in > England. We are getting a quote for 7500 gbp per month For 19 > square meters of space. In us we pay 3500 a month for 10x10 > cage at a quest facility Also I'd anyone can recommend some > british colo companies would appreciate it http://tinyurl.com/2b9tmj has good information about many London data centres. Definitely check what power is available, it is quite restricted at some locations.

1 0

ATT <-> Broadwing (Level3) Congestion
by Brandon Galbraith 16 May '07

16 May '07

Is anyone else seeing significant congestion between ATT and Broadwing in Dallas/Fort Worth? -brandon

3 3

VOIP and QOS across local network and the Internet
by Rick Kunkel 16 May '07

16 May '07

Hello all, We're getting an increasing amount of pressure from VOIP providers colocated with us and from VOIP end-users to prioritize traffic on our network. From a network administrator's point of view, I am sensing that this is the proverbial can of worms, and I'm hesitant to open it. I thought perhaps I could just do a quick survey, both of what people do on their individual networks, and of what they know about others. - Do you offer QOS services across your network for VOIP or other types of traffic? - Do you do this on a per-customer basis, or is it done globally? - If per customer, are there charges involved? - Are there any major carriers that give preference to VOIP traffic? I've heard rumors that Global Crossing does. I've also heard rumors that almost all of them do. I've also heard that almost none do. - For those that offer QOS services for VOIP, is traffic classification done by TCP layer protocol and port number? - It's hard for me to imagine major carriers implementing any kind of standardized classification. For instance, if most carriers agree that UDP traffic destined for ports Y through Z is VOIP and should thus be treated in a more time-sensitive manner, what's to prevent the newest version of BitTorrent to take advantage of this by fitting it's traffic to that profile? One of the things that makes VOIP so frustrating to the telcos - data is data is data - seems to bite VOIP in the ass here. Is my thinking correct? Or maybe traffic classification is happening at a higher layer? I can only imagine this issue growing larger. With streaming audio and video well-established, VOIP at the dawn of major acceptance, and Internet TV, movies, and other real-time dependent applications on the near horizon, it's looming large. I know aspects of this have been brought up before, notably the whole "the Internet core can't take it" conversation. I'm hoping my questions are a little more specific. (However, I do find the aforementioned threads quite fascinating, for the record.) Thanks, Rick Kunkel

4 3

IPv4 multihomed sites statistics
by Masafumi Watari 15 May '07

15 May '07

I'm looking for statistics that may provide hints on the number of IPv4 multihomed sites that exist today. Are there any pointers? Also, is there a way to find the average number of peers that these sites multihome with? If not, how large is it in general? thanks, watari

3 2